                             :value    subject-pub}]]
         (is (= (set exts) (set exts-expected)))))
 
-    (testing "trusted fact extensions are copied from CSR"
+    (testing "trusted fact extensions are properly unfiltered"
       (let [csr-exts [(utils/puppet-node-image-name "imagename" false)
                       (utils/puppet-node-uid "UUUU-IIIII-DDD" false)]
             csr      (utils/generate-certificate-request

                            :value #{:digital-signature :key-encipherment}}
                           {:oid "2.5.29.14"
                            :critical false
                            :value subject-pub}]]
        (is (= exts exts-expected))))))

(ns puppetlabs.master.certificate-authority-test
  (:import (java.io StringReader ByteArrayInputStream)
           (java.security MessageDigest))
  (:require [puppetlabs.master.certificate-authority :refer :all]
            [puppetlabs.trapperkeeper.testutils.logging :as logutils]
            [puppetlabs.certificate-authority.core :as utils]
